VMware publishes virtualisation security guidelines

VMware marked the second day of VMworld conferenceby sharing newly published security and compliance recommendations for virtual environments.


VMware marked the second day of VMworld conferenceby sharing newly published security and compliance recommendations for virtual environments.

The vendor's guidelines focus primarily on optimising use of management and security tools available from VMware parent company EMC and EMC's RSA security division.

VMware's paper, "Security Compliance in a Virtual World," calls attention to the fact that any corporate computing infrastructure that has been virtualised in part or in whole must meet the demands of auditors to satisfy regulatory mandates.

These include the Payment Card Industry data security standards (PCI DSS), federal Health Insurance Portability and Accountability Act healthcare security requirements, or the European Union's data-privacy rules, among other regulations worldwide.

Just as they would for a non-virtualised computing environment, compliance auditors will demand evidence of controls that prevent unauthorised access, provide separation of administrative duties, isolate systems for processing protected information, and monitor access.

In the paper, VMware acknowledges that virtualisation is still "relatively new" and that it "represents a paradigm shift in computing," so organisations "need to invest time and effort in learning how to get it right."

But virtualised and non-virtualised computing environments are profoundly different in nature. In virtualised environments, "there is no longer a one-on-one relationship between the physical host and server," VMware points out in the paper. "Now a virtual machine can run on one of many physical hosts, while a host can run a wide variety of virtual machines. This association changes dynamically, making it difficult to keep up with changes."

VMware adds: "The result is that configuration and change management practices become even more critical in virtualised environments."

Among the paper's recommendations, VMware says managers should take advantage of tools they already may use in their physical environments to lessen the burden of managing conformance in virtual infrastructures.

In terms of tools to use to meet compliance goals, the paper emphasises [VMware's vCenter and Orchestrator]; VMware Update Manager; RSA's enVision security information management product; and EMC Ionix Server Configuration Manager.

The paper also notes that the [Center for Internet Security] and the Defense Information Systems Agency have each issued guidelines on configuration and platform hardening in virtualisation.

Platform hardening relates to using "appropriate settings and removing unused code," says Bret Hartman, CTO at RSA. Hartman authored the paper with Stephen Herrod, CTO and senior vice president of research and development at VMware, and three others.

The reason for publishing "Security Compliance in a Virtual World" now, Hartman says, is that chief security officers are trying to anticipate security needs around virtualisation and want more practical advice.

"The risks are here," Hartman says. "What makes virtualisation different is there's a new kind of root access in the system."

Therefore, there should be "very strong administrative controls," says Hartman, recommending use of "multi-factor authentication," not just simple passwords, plus the establishment of a clear separation of duties.

In the paper, VMware acknowledges it wants to shift the security discussion away from what it sees as too much focus on hypervisor security alone, to the broader concerns of overall security compliance, auditing, logging and event collection.

A mix of virtualised and non-virtualised computing environments -- a commonplace situation in organisations today -- represents "a hybrid environment" that has to be administered and logged appropriately across both for regulatory reasons, Hartman points out, adding it's all taking place in an "evolutionary" way.

"Recommended For You"

Licensing under virtualisation - time for change Cisco funds virtualisation security start-up HyTrust